CIA Annual Meeting LOOKING BACK…focused on the future

Operational Risk Session 1602 LOOKING BACK…focused on the future Presenter Michel Desmarais Presenter Michel Desmarais

Operational Risk Session 1602 LOOKING BACK…focused on the future OPERATIONAL RISK

Operational Risk Session 1602 LOOKING BACK…focused on the future Development of a Framework for Managing Operational Risk

Operational Risk Session 1602 LOOKING BACK…focused on the future Table of contents o Introduction o Operational risk categories o Operational risk management framework o Conclusion

Operational Risk Session 1602 LOOKING BACK…focused on the future The risk universe for a life and health insurance company Reputational CreditOperational InsuranceStrategic LiquidityMarket

Operational Risk Session 1602 LOOKING BACK…focused on the future Risk Management Financial risks are generally well managed in life and health insurance companies because certain controls are set up, such as Investment policies Matching policies Pricing policies Etc…

Operational Risk Session 1602 LOOKING BACK…focused on the future Risk Management (cont’d) Operational risk is usually managed reactively (an event occurs and the company reacts by introducing a control). The goal of setting up an operational risk management framework is to manage operational risk proactively.

Operational Risk Session 1602 LOOKING BACK…focused on the future

Operational Risk Session 1602 LOOKING BACK…focused on the future Definition of Operational Risk Risk of inadequate or failed internal processes, people, and systems, or from external events resulting in loss, non- achievement of objectives or negative impact on reputation. It includes legal risk but excludes strategic and reputational risk. However, it does take into account the impact of failures that affect the achievement of strategic objectives and the company’s reputation.

Operational Risk Session 1602 LOOKING BACK…focused on the future XXX lost personal information on 3.9 millions of clients of YYY. Accusations are taken against managers of ABC Investment Securities. Investment Securities XYZ and his president must pay 2 millions of penalties. Examples of recent events resulting in operational losses:

Operational Risk Session 1602 LOOKING BACK…focused on the future Why is there so much talk about operational risk? Following the accounting scandals, certain laws were passed: Sarbanes-Oxley in the U.S. Bill 198 in Canada As well as the Basel II Accords that govern the world banking institutions and define the regulatory capital based on the management of credit risk, market risk and OPERATIONAL RISK

Operational Risk Session 1602 LOOKING BACK…focused on the future Basel II: 7 Operational Risk Categories 1. Internal fraud E.g.: unauthorized transactions; misappropriation of assets; forged signatures. 2. External fraud E.g.: robbery; stolen cheques; counterfeit money.

Operational Risk Session 1602 LOOKING BACK…focused on the future Basel II: 7 Operational Risk Categories (cont’d) 3. Employment practices and workplace safety E.g. organized labour activities, strikes; discrimination; general liability. 4. Clients, products and business practices E.g.: breach of privacy; money laundering; misuse of confidential information.

Operational Risk Session 1602 LOOKING BACK…focused on the future Basel II: 7 Operational Risk Categories (cont’d) 5. Damage to physical assets and public safety E.g.: natural disaster; terrorism; vandalism. 6. Business disruption and systems failures E.g.: breakdowns; software failure; utility disruption.

Operational Risk Session 1602 LOOKING BACK…focused on the future Basel II: 7 Operational Risk Categories (cont’d) 7. Execution, delivery and process management E.g.:data entry errors; missed deadline or responsibility; vendor disputes.

Operational Risk Session 1602 LOOKING BACK…focused on the future

Operational Risk Session 1602 LOOKING BACK…focused on the future What about life and health insurance companies? The Basel II Accords do not apply directly to life and health insurance companies. OSFI and Quebec’s AMF are considering the possibility of changing how the MCCSR is calculated to account for operational risk specifically rather than implicitly.

Operational Risk Session 1602 LOOKING BACK…focused on the future Important factors for setting up an operational risk management framework Framework and policies; RCSA program; Risk indicators; Database; Disclosure, communication and accountability.

Operational Risk Session 1602 LOOKING BACK…focused on the future Framework and policies Helps to control operational risk management through all business units. Gives managers and employees the tools they need to manage operational risk.

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program Risk and Control Self-Assessment. Helps people understand the risks the company is exposed to. Develops a better understanding and appreciation of the control environment.

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program Definition:ongoing process used by companies to identify and assess the risks inherent in their activities and the quality of the controls associated with these risks in order to establish the level of residual risk.

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d) 6-Step Program 1. Identify and document the sector or line of business to be assessed 2. Assess the risk factors and identify the inherent risks

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d) Risk factor Inherent risk Inherent operational activity that exposes the sector or line of business to risk Estimated level of OR without taking the pertinent controls into account

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d) 3. Assess the inherent risks and their trends. Evaluation of the frequency and severity of each risk situation

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d) 4. Document and assess the controls to determine their effectiveness Use of a COSO (Committee of Sponsoring Organisations), COCO, COBIT, etc. model. It is possible to evaluate controls at different levels, from control environnement to specific controls. When we evaluate specific controls, it is important to perform it with individuals having an in-depth knowledge of the operations and the control practices in place.

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d) 5. Determine the residual risks Residual risk:Estimated level of OR after the impact of the pertinent controls

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d)

Operational Risk Session 1602 LOOKING BACK…focused on the future

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d) 6. Develop action plans for Definitely the most important step of the program. managing exposure to risks deemed unacceptable.

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d) Program output 1. Risk profile (risk tables or maps) 2. Key risk indicators 3. In the longer term, optimization of the capital allocation process associated with operational risks

Operational Risk Session 1602 LOOKING BACK…focused on the future RCSA Program (cont’d) Roles and responsibilities The operational risk management function coordinates and facilitates the implementation of the RCSA program. The business lines lend their expertise to help identify and measure the risks and to assess the controls and their effectiveness. They also develop and carry out the action plans.

Operational Risk Session 1602 LOOKING BACK…focused on the future Risk Indicators Allow for proactive risk management Represent an important control tool Definition: element of information that reflects an assessment, observation or data used to identify or anticipate a risk, its trend or its probability of occurring. It’s important to determine the right indicators

Operational Risk Session 1602 LOOKING BACK…focused on the future Database Used to collect and document events that have generated operational losses Used to assess the company’s operational risks Used to document quasi-losses or prevented losses

Operational Risk Session 1602 LOOKING BACK…focused on the future Database (cont’d) Used to document operational deficiencies Used to model operational losses Used to develop key indicators May include data from external operational losses

Operational Risk Session 1602 LOOKING BACK…focused on the future Disclosure, communication and accountability Communication needs to go both ways: Top-down: Management sets tolerance limits Bottom-up: Managers and employees inform management of the risks and controls

Operational Risk Session 1602 LOOKING BACK…focused on the future Conclusion Key factors for setting up an operational risk management framework Buy-in of senior management Communication Risk report Framework and policies Time required: minimum 3 years

Operational Risk Session 1602 LOOKING BACK…focused on the future

Operational Risk Session 1602 LOOKING BACK…focused on the future QUESTIONS